2016-12-12 Locky "Software License"

2016-12-12 #locky email phishing campaign "Software License"

Sample email:
----------------------------------------------------------------------------------------------------------------------------
From: "Zachariah Finch" <Finch.Zachariah@hundkurserforalla.se>
To: [REDACTED]
Subject: Software License
Date: Mon, 12 Dec 2016 16:50:51 +0530

Hello [REDACTED], it is Zachariah.
Sending you the scan of the software license agreement (Order #5434052).
It is in the attachment. Please look into it ASAP.

----
Best Regards,
Zachariah Finch

Attachment: softlic_5434052.zip -> ~Z9OK0OB3TN495M0OM51Q143N.wsf
----------------------------------------------------------------------------------------------------------------------------
- sender varies between emails
- subject is "Software License"
- attached file "softlic_<7 digits>.zip" contains file "~<15+ uppercase chars and digits>.wsf", a JScript downloader

Download sites:
http://bestbuylocal.com/ebboelbvs
http://bestbuylocal.com/g2jvhsj9
http://bestbuylocal.com/jfrtat
http://bestbuylocal.com/vbaa8ys
http://bestbuylocal.com/ycohx
http://bestbuylocal.com/ykbbwq
http://goodfoodprod.xyz/1exhfeofq9
http://goodfoodprod.xyz/avntp
http://goodfoodprod.xyz/cq8bqngvv
http://goodfoodprod.xyz/ixtd7wctq
http://goodfoodprod.xyz/oxw8e
http://goodfoodprod.xyz/yxurej67wf
http://qijiaosoft.com/xb4bwcomo
http://rent-guarantee-insurance.co.uk/kuyzc
http://rnaweb.nl/lib46
http://sinanagirman.com/glouswg3g
http://skpc.org.au/skhaxqghvx
http://slipko.ru/rrbjjgb
http://sobretesis.com/nunltpk
http://softwarecomparel.org/a8ytyay8
http://softwarecomparel.org/bc1pmv
http://softwarecomparel.org/gfigo3ezn3
http://softwarecomparel.org/lcv3ysact
http://softwarecomparel.org/miaoaty9n
http://softwarecomparel.org/xv9ecbtgj
http://sorrentovalleypainrelief.com/ky9rk
http://sovereignkitchens.com.au/gzttjwu9xp
http://speciaaldesign.nl/xuazakski
http://speckftp.de/ev1hcdxt
http://sportsarena.gr/xjrue
http://staygray.com/kxwcgnu
http://staygray.com/mivftkxnmp
http://stephaniemiddendorp.nl/h05ld2sut
http://stjohns2012.ca/vn1wvzjk
http://studioangelucci.eu/kmdkffw
http://syedtradingco.com/yq6pp5kfu
http://syncfish.com/qdzzef
http://systemrma.pl/lumigwma
http://t38faxvoip.com/yz3w7mn
http://tbhomeinspection.com/mwo7gb
http://tdtx.cn/zvzenep
http://techpow.net/xme9kj
http://teknoportbilisim.com/mkqamw6n
http://tengalo.com/fwzysh
http://the-agathon.com/gvcid8b
http://thecodega.com/xegesuly
http://thenumastore.com/k8f5irc
http://theory.issp.ac.cn/xcemhkbr
http://thxlove.com/odulqznn7
http://tikrasturtas.lt/f8cfwlon
http://tinybearshop.com/zlogeol
http://tivicast.org/khlmwxrb
http://tobybender.com/t4z8xrgdxz
http://toyallstar.com/kohknfsf
http://trade-unite.ru/k2qplhwug
http://translate-all.eu/tdc7xep8yy
http://trehoada.org/yuinghwmsz
http://trendsandtrades.nl/wigm99l
http://trilab.sk/epimbssz
http://usedtextilemachinerylive.com/f5ee9qaadu
http://v4c.tv/6arm9pnzr1
http://valtho.com/6phqkll
http://vanks.cl/2t3huwd
http://villa64.dk/19tew8i
http://vipseal.de/mvhhdq
http://vodatelsys.com.cn/58lupnimb
http://waner888.com/4go17e
http://watchesheaven.com/altxyjw
http://wflife.net/87o3ozdd
http://wordpad.org/7ks1j
http://wphone3c.com/6ap7em
http://wreckingcrewnow.com/bfnfwyt87y
http://wywfanp.com/4vasxe0mx
http://xangelle.com/8wlji
http://yes2malaysia.com/aekwxxd0e

UPDATED:
http://smartfoodbuys.com/g2dznw
http://thcr.com/f3g2xlxcvb
http://zamiri.com/bsb6ql

Malware
- encoded on download:
6c240457360a184035d9c61157762874bd750b9dd17aac0c1d5140a793da1c1f  http___bestbuylocal.com_ebboelbvs
82f8af07906ca58c34b3bc50ade9de8aff43bd7f75b21b22ea8641f1087297da  http___bestbuylocal.com_g2jvhsj9
7ce38ba0095ce0f7c6eea4c68ee286181e52efbf9bd62eaf1b369e3ff6654129  http___bestbuylocal.com_jfrtat
6982f13f6ddc8a3b5f588d850799edd262604110c7157fad35543faef87a69e0  http___bestbuylocal.com_vbaa8ys [1]
00836a1123532fbdfe96ff09358562982076e9a3ca8dbc036a26721cc4b570e1  http___bestbuylocal.com_ycohx
39ecd50a786a05483232d5d8e225a8b2a93c2ab104e926d0e4b0638c3793e5f4  http___bestbuylocal.com_ykbbwq
436fcd82ea790ba1e624bf4901999f448e0c5451875a3839c32631425b5b139c  http___goodfoodprod.xyz_1exhfeofq9
3a7f4f2ea8ae35f61a4363b313684655d478e00e1968dbf8206888d109225f5a  http___goodfoodprod.xyz_avntp
b76cf76b6be672c5ac01498dfcb11bf8faa69850f9005ab44aa8637910faeb03  http___goodfoodprod.xyz_cq8bqngvv
7088c77e934514a88bbd1d7715482d47d076e0d70fad73249b602e7a3bccd56f  http___goodfoodprod.xyz_ixtd7wctq
2c7efb537d860c5ea416ec3a2710d7090eb3c238462c74d265bce6052a7fe3a2  http___goodfoodprod.xyz_oxw8e
642d73b3ade4f40a139f44ecb7fe6b15d29ac928917192827aa58b50c2ecf87d  http___goodfoodprod.xyz_yxurej67wf
d678844a59cc1165323b8394b4ced2d04725f3bcb41bb06751d5aab8b026c041  http___qijiaosoft.com_xb4bwcomo
6ad19b97942c8a1c9645afedf24216893e0518cd5e7228bd511d8aa66d43bf5e  http___rent-guarantee-insurance.co.uk_kuyzc
7d23a9e12393ba31f5515532b3c5d30368adf1d7c19f02c4ac6c71582267c7c6  http___rnaweb.nl_lib46 [4]
14a35c37f6dab8be3eff608f03553e492186358fa60c832ec263d8564dc5bc0d  http___sinanagirman.com_glouswg3g
ea75041ff4bd473db262abdbe48b053be966d8c76b2bdce4ddee3d07ffaf3c78  http___skpc.org.au_skhaxqghvx
e0dd4f363afb34457649803fe84c190815159f4329b3fb698235514346d146df  http___slipko.ru_rrbjjgb
4cd284e46b4b0f4eb9f8c62d94a8a1451ce3c538cfa95c6d5d4bb323ef016cf7  http___sobretesis.com_nunltpk
4ef2782bfb9b1d06a2e078bf5ae2ccd96d2103344c529ff4cbbec52898f0f440  http___softwarecomparel.org_a8ytyay8
9f525417034f03161834dc8065098a68fed6d26156037c781e50c24ac93f365e  http___softwarecomparel.org_bc1pmv
3c5c9e53ac0419dff9b85dea2fd09a49689fce9f010bdff153b108af23b2b419  http___softwarecomparel.org_gfigo3ezn3
ae506384c7636cf9794c9501ec4d5c31be4d0ee3697282c4ed12672be28d8f8b  http___softwarecomparel.org_lcv3ysact
d09ebf1541419c8057aeec586b83c170a1ea5c345d541fdc7c33f213dc1f0723  http___softwarecomparel.org_miaoaty9n
d22dcbcb8bc2a610f4331312380f77daf0cba9f4513a5624b899c758e0e76677  http___softwarecomparel.org_xv9ecbtgj
ba5aa03d724d17312d9b65a420f91285caff711e2f891b3699093cc990fdaae0  http___sorrentovalleypainrelief.com_ky9rk
aaeacc5507be1cb771d0df740e389849a417bdc259f64fba0f368639629d6d33  http___sovereignkitchens.com.au_gzttjwu9xp
e49108967bf25018b37a9003ccbea4e995257ef598076d9c95c4718ace5c5df4  http___speciaaldesign.nl_xuazakski
f32aa3677fab56060e02e8275f518ffe714c8a2ca37f127e869464e740aac2e9  http___speckftp.de_ev1hcdxt
6dbecfffa73aa316b67c4adcad0529cfd077a44f002dbd499c953dd57dae063e  http___sportsarena.gr_xjrue
70f726faad3d308f69e078277490223feaa610d808774d7dd20cf3d1b602771c  http___staygray.com_kxwcgnu
2f7fec278ddf37c67d062b4c46fa16fbea2cdb7d9d5cfe739599736ce9759749  http___staygray.com_mivftkxnmp
938b29ef27b15b968599b4e398c0e98989496a077cfe2ed61781acd3593a415a  http___stephaniemiddendorp.nl_h05ld2sut
ebef46f2525369da429ade7192c616a09bda1d4e3b178f4b09524c2a5b7420be  http___stjohns2012.ca_vn1wvzjk
0f46d8774e4d0f2c9d544adb12204185a9d2d040e7670bb6b9a0ad700636ece7  http___studioangelucci.eu_kmdkffw
0743495293b35912ae279d980ef65a91311b140a0fbc46e410f49f5a0338fd9d  http___syncfish.com_qdzzef
336d5c2872f48df0438f3fd06b661a1265234540176a1d6e674bd301f3ef2412  http___systemrma.pl_lumigwma
1ab91e13c366d7821d043d03293c7075da42610860199cd115f0191ed5c92df2  http___t38faxvoip.com_yz3w7mn
35b0ac0b34949c988998259db6f871013289d24fd5f4992f2dbe180d3016504b  http___tbhomeinspection.com_mwo7gb
495d947f5355dc0dbf7a1f5f2265ccae1ec3bbbba7a13473b3724d3f7e19668b  http___techpow.net_xme9kj [5]
fe101e6a832c5abad7bc93a1dc084b82cfa2eae0ce49ea822e44a74cf0240406  http___teknoportbilisim.com_mkqamw6n
07cb813888ba2d1749a70c509db8f58bd1513a82076ea7c786219280aa749cb7  http___tengalo.com_fwzysh
ef13189ec4dc48b315477d4eea293e84e3a46e58498f1496cbdece75d906958d  http___the-agathon.com_gvcid8b
3f7d0ade8b072b97de1ce6af9d6198558c581abd8311c0a558e97db185132add  http___thecodega.com_xegesuly
57a89413d4feb0a6fb53f7de5d79c1ddae90e94467761948fbc15e88c1f33677  http___theory.issp.ac.cn_xcemhkbr [2]
e13e9a52f0d38101b43d25a401133b293304aa8a8c76cd97f4d5aaa1276d7240  http___thxlove.com_odulqznn7
53488a8bba05a8565c8d5cddb6182e5f1424d13d477466637fdd9565a536f97b  http___tinybearshop.com_zlogeol [3]
a8f56da9ae47d0afc1c10c043846f9094c3dd24e8a0f08123f9a47bf7506c471  http___tivicast.org_khlmwxrb
324028c7b75ced6d643038d77a89973cb1443d15fd30e4e06a1a8b4b90081468  http___tobybender.com_t4z8xrgdxz
0fb8a5628f8324d4c953f3f8abf1db535c6da21183e89db5eaa0ba81eaeea4fa  http___toyallstar.com_kohknfsf
0e155e49aaccb4745ec41e06d87e351403a064759f21d828587e326cf8c1173e  http___trade-unite.ru_k2qplhwug
7bc4ab4a930525f38f1da56e0b9957632236ef27dc4d30f627449caa49671580  http___translate-all.eu_tdc7xep8yy
6119c70af8fe33fb465ec81084700be4e5b46422efaab30468185c87de91bd1d  http___trehoada.org_yuinghwmsz
3674f42841fbda919aadce725f0b977219f06b5fecba21f9187c39d59f0b4f5d  http___trendsandtrades.nl_wigm99l
f616fa9d194b3381e5e925be9d222cd14940a7aee7fa0bc45ddffd0270071795  http___trilab.sk_epimbssz
d8cae33291181cc00ee04953be02d7043b9e1c47c22b5feafcdb0f0b9b4c6127  http___v4c.tv_6arm9pnzr1
7b431bd614690f420f9deba4cad3cc291e90a49e974fe2be7cea7f24c0ad0cb7  http___vanks.cl_2t3huwd
50ea9164fab21ec93c63ded772eb651ddc64ad3f8ff73b001579d3b816130970  http___villa64.dk_19tew8i
96d7d8f82dec80450db10412ecbc84f60a8f2fe5b006923b63899f5581c2a065  http___vipseal.de_mvhhdq
31b74aa8c4bfea1046ea599b275866d1a8e05872160bb03347d5ab6d2b211d56  http___vodatelsys.com.cn_58lupnimb
40b523ea24f1d8a86a415306d3a088971276dd5e5b89e293121423a9d3afefdd  http___waner888.com_4go17e
5812e92b756fb330c238fd198a70e19a9492c5721a6461741cc252726a88e236  http___wflife.net_87o3ozdd
f67f079aafe44a6e3671981729e811f89104af71d07e310ecf2ccc3e97c0141f  http___wordpad.org_7ks1j
db3c8e9874a8051904be88b3a5288fb96dc76c9461c65347e3516ece7709cba1  http___wphone3c.com_6ap7em
71f266b9dd2dd96ae9cfb248aa59ecd6fda27bafd1dc30ce39906488867e100b  http___wreckingcrewnow.com_bfnfwyt87y
2be8ec6667022433ba1c1e7e4e28c6170769bc2923ad70e9ba8e8ea0a0c9eb57  http___xangelle.com_8wlji
- decoded
b3a6589f9d8848c89640bd822a674fe1169846fb321a9df82b93d15f0bcd8386 [1]
d531179eb52a2e1ff66cdba1239dee39f7503046091072ca796eceb402e92322 [2]
46e6b1fec964bbbeebe26370f8513cb082e42a8f12975c8088773962e82919ae [3]
6897c919c63f6570dbe7b0ccd85739d56f05366ed4f9908f837ccf59193caa03 [4]
30a13967591a22b54707d2a8e3016e2aec8317aebfe324165c2246198ff41eec [5]
- executed by "rundll32.exe %TEMP%\<filename>.ZK,64Hq4CTd1F2mXYBw"
- samples
https://www.virustotal.com/file/b3a6589f9d8848c89640bd822a674fe1169846fb321a9df82b93d15f0bcd8386/analysis/1481543687/ [1]
https://www.virustotal.com/file/d531179eb52a2e1ff66cdba1239dee39f7503046091072ca796eceb402e92322/analysis/1481543734/ [2]
https://www.virustotal.com/file/46e6b1fec964bbbeebe26370f8513cb082e42a8f12975c8088773962e82919ae/analysis/1481543749/ [3]
https://www.virustotal.com/file/6897c919c63f6570dbe7b0ccd85739d56f05366ed4f9908f837ccf59193caa03/analysis/1481543769/ [4]
https://www.virustotal.com/file/30a13967591a22b54707d2a8e3016e2aec8317aebfe324165c2246198ff41eec/analysis/1481543785/ [5]

C2:
POST http://185.46.11.236/checkupdate
POST http://91.200.14.109/checkupdate
POST http://93.170.104.23/checkupdate
POST http://95.213.224.117/checkupdate